4 ms·

Is there a test I can use to confirm that it's working? I've set privacy.firstparty.isolate true and privacy.firstparty.isolate.restrict_opener_access true and

Is there a test I can use to confirm that it's working? I've set privacy.firstparty.isolate true and privacy.firstparty.isolate.restrict_opener_access true and when I log in to Github followed by Travis, Travis was able to log in without prompting for a password.... Firefox 62 macOS. Edit: I did lose all my cookies on restart, so I do believe the option is at least enabled. Still would like to test that it's actually doing something.

floatingatoll 8y ago
Did you restart between changing the settings and doing your tests? If not, they’re invalid, and you should repeat them.
Aeolun 8y ago
If Travis redirects to github, I assume github would get access to it’s own cookies again, and then be able to perform oauth, after which it redirects to Travis again with a token in the URL, no cookies or local storage needed as far as I’m aware.
tomrittervg 8y ago
Go to https://ritter.vg/misc/ff/fpi.html https://ritter.vg/misc/ff/fpi.html On first load it should say "There was nothing in local storage." Now go to https://rittervg.com/misc/ff/fpi.html https://rittervg.com/misc/ff/fpi.html On first load it should say the same. If it says the same timestamp that was stored on the first page - it's not working. Source: I'm a Mozilla Developer who is one of the primary devs/supporters of First Party Isolation.
- fredsir 8y ago
  Seems to be working, thanks! (had to disable blocking of third-party trackers for it to function, but after that, it works as promised, and I have re-enabled blocking of third-party trackers)
- user812 8y ago
  What if the box is empty? JS is allowed. (Edit: I guess the culprit is "third party cookies blocked by default") So wouldn't a better test be about a third party that was used in a first party context before? Since FPI goes beyond third party cookies.
  - tomrittervg 8y ago
    Thanks for diagnosing that for me, you're right blocking third party cookies does cause it to fail. Both tests are equally valid. I just gave one because trying to be exhaustive about testing it would be mind-numbing. The test I provded only does localstorage, but FPI also isolates DNS cache, H2, image cache, favicons, cookies, localstorage, indexdb, etc etc You can do yours by visiting https://anonymity.is/misc/ff/fpi-iframe.html https://anonymity.is/misc/ff/fpi-iframe.html first; then visit the ritter.vg and rittervg.com links.
    - user812 8y ago
      Thanks for the clarification. What surprises me the most is that not only Firefox but also my Safari Browser passes all those tests when ITP is enabled.
      - tomrittervg 8y ago
        Safari by default has a stricter storage access policy by default for all third-party domains, which requires you to visit the domain as a first party first. So it's probably that rather than ITP.
        user812 8y ago
        I have a general question if you don't mind. I use Firefox Beta. Why is Firefox going the route of a manual blacklist (disconnect) instead of working on some kind of programmatic machine-learning/somewhat intelligent third-party storage blocking by default that doesn't discriminate known against unnkwon trackers?

floatingatoll 8y ago

Did you restart between changing the settings and doing your tests? If not, they’re invalid, and you should repeat them.

Aeolun 8y ago

If Travis redirects to github, I assume github would get access to it’s own cookies again, and then be able to perform oauth, after which it redirects to Travis again with a token in the URL, no cookies or local storage needed as far as I’m aware.

tomrittervg 8y ago

Go to https://ritter.vg/misc/ff/fpi.html https://ritter.vg/misc/ff/fpi.html On first load it should say "There was nothing in local storage." Now go to https://rittervg.com/misc/ff/fpi.html https://rittervg.com/misc/ff/fpi.html On first load it should say the same. If it says the same timestamp that was stored on the first page - it's not working. Source: I'm a Mozilla Developer who is one of the primary devs/supporters of First Party Isolation.

fredsir 8y ago
Seems to be working, thanks! (had to disable blocking of third-party trackers for it to function, but after that, it works as promised, and I have re-enabled blocking of third-party trackers)
user812 8y ago
What if the box is empty? JS is allowed. (Edit: I guess the culprit is "third party cookies blocked by default") So wouldn't a better test be about a third party that was used in a first party context before? Since FPI goes beyond third party cookies.
- tomrittervg 8y ago
  Thanks for diagnosing that for me, you're right blocking third party cookies does cause it to fail. Both tests are equally valid. I just gave one because trying to be exhaustive about testing it would be mind-numbing. The test I provded only does localstorage, but FPI also isolates DNS cache, H2, image cache, favicons, cookies, localstorage, indexdb, etc etc You can do yours by visiting https://anonymity.is/misc/ff/fpi-iframe.html https://anonymity.is/misc/ff/fpi-iframe.html first; then visit the ritter.vg and rittervg.com links.
  - user812 8y ago
    Thanks for the clarification. What surprises me the most is that not only Firefox but also my Safari Browser passes all those tests when ITP is enabled.
    - tomrittervg 8y ago
      Safari by default has a stricter storage access policy by default for all third-party domains, which requires you to visit the domain as a first party first. So it's probably that rather than ITP.
      - user812 8y ago
        I have a general question if you don't mind. I use Firefox Beta. Why is Firefox going the route of a manual blacklist (disconnect) instead of working on some kind of programmatic machine-learning/somewhat intelligent third-party storage blocking by default that doesn't discriminate known against unnkwon trackers?